Dashboards & Visualizations
Highlighted

Create drop-down list using response of search

New Member

hi, I am trying to populate my drop-down list with a search result of a minute.
My main search is : version error* | table dateyear,datemonth,datemday,dateminute,datesecond ,version,host,error,source | mvexpand error| rename dateyear as year| sort day,minute,second |fillnull value="not defined" year,version,error*
i am retriving the minutes by using - | stats count by date_minute
the search retuns table data but no data returned in the drop down list

I try to attache xml but there is some issues in the editor so i converted to json

{
"form": {
"label": "Dashboard test",
"search": {
"query": "version* error* | table dateyear,datemonth,datemday,dateminute,datesecond ,version,host,error,source | mvexpand error| rename dateyear as year| sort day,minute,second |fillnull value=\"not defined\" year,version,error",
"id": "basesearch"
},
"fieldset": {
"input": {
"search": {
"query": "| stats count by dateminute",
"
base": "basesearch"
},
"fieldForLabel": "date
minute",
"fieldForValue": "dateminute",
"
type": "dropdown",
"token": "dateminute",
"searchWhenChanged": "true"
},
"
submitButton": "false"
},
"row": {
"panel": {
"table": {
"title": "Minute",
"search": {
"query": "version error* | table dateyear,datemonth,datemday,dateminute,datesecond ,version,host,error,source | mvexpand error| rename dateyear as year| sort day,minute,second |fillnull value=\"not defined\" year,version,error| stats count by dateminute",
"earliest": "0",
"latest": ""
},
"option": [
{
"
name": "wrap",
"text": "true"
},
{
"_name": "rowNumbers",
"
text": "false"
},
{
"name": "drilldown",
"
text": "cell"
},
{
"
name": "dataOverlayMode",
"text": "none"
},
{
"_name": "count",
"
text": "10"
}
]
}
}
}
}
}

0 Karma
Highlighted

Re: Create drop-down list using response of search

Communicator

Hi @mb_30

Looks like you havent used the search token to be defined against anything. I think even though your token name is date_minute it doesnt understand its that specific data set to pull through. You would need to define this in the dropdown

If you open the dashboard in edit mode and try adding the below into your source data (hopefully this should be close based on the version of splunk you are using)

 <input type="dropdown" token="date_minute" searchWhenChanged="true">
      <label>Dashboard Test</label>
      <choice value="*">ALL</choice>
      <prefix>date_minute="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>date_minute</fieldForLabel>
      <fieldForValue>date_minute</fieldForValue>
      <search>
        <query>version error* | table date_year,date_month,date_mday,date_minute,date_second ,version,host,error,source | mvexpand error| rename date_year as year| sort day,minute,second |fillnull value=\"not defined\" year,version,error | table date_minute</query>
        <earliest>@m</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
0 Karma
Highlighted

Re: Create drop-down list using response of search

New Member

it didn't help, please advise
attaching a screenshot of the result.

As you see in the screenshot I have a table that returns minutes Ialt text need to get these minutes to the dropdown list, then selection of minutes should influence the table in the screenshot.

0 Karma
Highlighted

Re: Create drop-down list using response of search

Communicator

If you use the search string in the token options do any search results come back?

You could try one of the below if it doesnt and use this as the search string

version error* | table date_year,date_month,date_mday,date_minute,date_second ,version,host,error,source | mvexpand error| rename date_year as year| sort day,minute,second |fillnull value=\"not defined\" year,version,error | stats count by date_minute

or try this

version error* | table date_year,date_month,date_mday,date_minute,date_second ,version,host,error,source | mvexpand error| rename date_year as year| sort day,minute,second |fillnull value=\"not defined\" year,version,error | stats count by minute

If you could post the source code for that token to have a look as well to see what has changed

0 Karma
Highlighted

Re: Create drop-down list using response of search

New Member

hi, thanks I added the search to the drop-down list and it worked but the result of the drop-down list does not match to the result of the statistic table.

0 Karma
Highlighted

Re: Create drop-down list using response of search

Communicator

Hi @mb_30

Can you provide a screenshot so i can have a look further?

0 Karma
Highlighted

Re: Create drop-down list using response of search

Communicator

Just had another thought. It may be to do with the time frame is not set far enough back.

when you go into edit mode and click on the pencil to edit the dropdown. Underneath the search string is the time field. Make sure this is set far enough back so it can pick up all the minutes that have been available in the past so you can use it to parse into your search.

Maybe use the default range of 'year to date' so it picks up everything this year

0 Karma
Highlighted

Re: Create drop-down list using response of search

New Member
0 Karma
Highlighted

Re: Create drop-down list using response of search

New Member
0 Karma
Highlighted

Re: Create drop-down list using response of search

Communicator

if its not matching then it must be picking up a different search.

Can you provide the search string for the table it relates to called error table?

0 Karma